{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"High" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"curl security update", "category":"general", "title":"Synopsis" }, { "text":"An update for curl is now available for openEuler-24.03-LTS-SP4", "category":"general", "title":"Summary" }, { "text":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\n\nSecurity Fix(es):\n\nA use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation.(CVE-2026-10536)\n\nWhen a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.(CVE-2026-12064)\n\nA vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.(CVE-2026-8286)\n\nA flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n'super cookies' that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.(CVE-2026-8924)\n\nWhen reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.(CVE-2026-8927)\n\nWhen a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)", "category":"general", "title":"Description" }, { "text":"An update for curl is now available for openEuler-24.03-LTS-SP4.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"High", "category":"general", "title":"Severity" }, { "text":"curl", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2026-2988", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2988" }, { "summary":"CVE-2026-10536", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-10536&packageName=curl" }, { "summary":"CVE-2026-12064", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-12064&packageName=curl" }, { "summary":"CVE-2026-8286", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-8286&packageName=curl" }, { "summary":"CVE-2026-8924", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-8924&packageName=curl" }, { "summary":"CVE-2026-8927", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-8927&packageName=curl" }, { "summary":"CVE-2026-9547", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-9547&packageName=curl" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12064" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9547" }, { "summary":"openEuler-SA-2026-2988 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-2988.json" } ], "title":"An update for curl is now available for openEuler-24.03-LTS-SP4", "tracking":{ "initial_release_date":"2026-07-21T09:46:18+08:00", "revision_history":[ { "date":"2026-07-21T09:46:18+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-07-21T09:46:18+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-07-21T09:46:18+08:00", "id":"openEuler-SA-2026-2988", "version":"1.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"openEuler-24.03-LTS-SP4", "name":"openEuler-24.03-LTS-SP4" }, "name":"openEuler-24.03-LTS-SP4", "category":"product_version" } ], "category":"product_name" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"curl-8.4.0-32.oe2403sp4.x86_64.rpm", "name":"curl-8.4.0-32.oe2403sp4.x86_64.rpm" }, "name":"curl-8.4.0-32.oe2403sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"curl-debuginfo-8.4.0-32.oe2403sp4.x86_64.rpm", "name":"curl-debuginfo-8.4.0-32.oe2403sp4.x86_64.rpm" }, "name":"curl-debuginfo-8.4.0-32.oe2403sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"curl-debugsource-8.4.0-32.oe2403sp4.x86_64.rpm", "name":"curl-debugsource-8.4.0-32.oe2403sp4.x86_64.rpm" }, "name":"curl-debugsource-8.4.0-32.oe2403sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"libcurl-8.4.0-32.oe2403sp4.x86_64.rpm", "name":"libcurl-8.4.0-32.oe2403sp4.x86_64.rpm" }, "name":"libcurl-8.4.0-32.oe2403sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"libcurl-devel-8.4.0-32.oe2403sp4.x86_64.rpm", "name":"libcurl-devel-8.4.0-32.oe2403sp4.x86_64.rpm" }, "name":"libcurl-devel-8.4.0-32.oe2403sp4.x86_64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"noarch", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"curl-help-8.4.0-32.oe2403sp4.noarch.rpm", "name":"curl-help-8.4.0-32.oe2403sp4.noarch.rpm" }, "name":"curl-help-8.4.0-32.oe2403sp4.noarch.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"curl-8.4.0-32.oe2403sp4.aarch64.rpm", "name":"curl-8.4.0-32.oe2403sp4.aarch64.rpm" }, "name":"curl-8.4.0-32.oe2403sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"curl-debuginfo-8.4.0-32.oe2403sp4.aarch64.rpm", "name":"curl-debuginfo-8.4.0-32.oe2403sp4.aarch64.rpm" }, "name":"curl-debuginfo-8.4.0-32.oe2403sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"curl-debugsource-8.4.0-32.oe2403sp4.aarch64.rpm", "name":"curl-debugsource-8.4.0-32.oe2403sp4.aarch64.rpm" }, "name":"curl-debugsource-8.4.0-32.oe2403sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"libcurl-8.4.0-32.oe2403sp4.aarch64.rpm", "name":"libcurl-8.4.0-32.oe2403sp4.aarch64.rpm" }, "name":"libcurl-8.4.0-32.oe2403sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"libcurl-devel-8.4.0-32.oe2403sp4.aarch64.rpm", "name":"libcurl-devel-8.4.0-32.oe2403sp4.aarch64.rpm" }, "name":"libcurl-devel-8.4.0-32.oe2403sp4.aarch64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"curl-8.4.0-32.oe2403sp4.src.rpm", "name":"curl-8.4.0-32.oe2403sp4.src.rpm" }, "name":"curl-8.4.0-32.oe2403sp4.src.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"curl-8.4.0-32.oe2403sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "name":"curl-8.4.0-32.oe2403sp4.x86_64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"curl-debuginfo-8.4.0-32.oe2403sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "name":"curl-debuginfo-8.4.0-32.oe2403sp4.x86_64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"curl-debugsource-8.4.0-32.oe2403sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "name":"curl-debugsource-8.4.0-32.oe2403sp4.x86_64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"libcurl-8.4.0-32.oe2403sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "name":"libcurl-8.4.0-32.oe2403sp4.x86_64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"libcurl-devel-8.4.0-32.oe2403sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "name":"libcurl-devel-8.4.0-32.oe2403sp4.x86_64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"curl-help-8.4.0-32.oe2403sp4.noarch.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "name":"curl-help-8.4.0-32.oe2403sp4.noarch as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"curl-8.4.0-32.oe2403sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "name":"curl-8.4.0-32.oe2403sp4.aarch64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"curl-debuginfo-8.4.0-32.oe2403sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "name":"curl-debuginfo-8.4.0-32.oe2403sp4.aarch64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"curl-debugsource-8.4.0-32.oe2403sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "name":"curl-debugsource-8.4.0-32.oe2403sp4.aarch64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"libcurl-8.4.0-32.oe2403sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "name":"libcurl-8.4.0-32.oe2403sp4.aarch64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"libcurl-devel-8.4.0-32.oe2403sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "name":"libcurl-devel-8.4.0-32.oe2403sp4.aarch64 as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"curl-8.4.0-32.oe2403sp4.src.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src", "name":"curl-8.4.0-32.oe2403sp4.src as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2026-10536", "notes":[ { "text":"A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ], "details":"curl security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2988" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":4.7, "vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-10536" }, { "cve":"CVE-2026-12064", "notes":[ { "text":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ], "details":"curl security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2988" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-12064" }, { "cve":"CVE-2026-8286", "notes":[ { "text":"A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ], "details":"curl security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2988" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-8286" }, { "cve":"CVE-2026-8924", "notes":[ { "text":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n'super cookies' that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ], "details":"curl security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2988" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":6.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-8924" }, { "cve":"CVE-2026-8927", "notes":[ { "text":"When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ], "details":"curl security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2988" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-8927" }, { "cve":"CVE-2026-9547", "notes":[ { "text":"When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ], "details":"curl security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2988" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.4, "vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.x86_64", "openEuler-24.03-LTS-SP4:curl-help-8.4.0-32.oe2403sp4.noarch", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debuginfo-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-debugsource-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:libcurl-devel-8.4.0-32.oe2403sp4.aarch64", "openEuler-24.03-LTS-SP4:curl-8.4.0-32.oe2403sp4.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-9547" } ] }